GoCardless
Products
1- 3 CVEs
Recent CVEs
3| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-119037 | Hig | 0.49 | 7.5 | 0.00 | Oct 30, 2026 | Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty… | ||
| CVE-2026-119036 | Hig | 0.49 | 7.5 | 0.00 | Oct 30, 2026 | Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is… | ||
| CVE-2026-119038 | Med | 0.40 | 6.1 | 0.00 | Oct 30, 2026 | Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect… |
- risk 0.49cvss 7.5epss 0.00
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, both of which Digest::SHA treats as an empty…
- risk 0.49cvss 7.5epss 0.00
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild the signed string, the payload is…
- risk 0.40cvss 6.1epss 0.00
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It reads the redirect…